CVE-2025-43973: GoBGP Input Length Verification Vulnerability
Summary
CVE-2025-43973: GoBGP does not verify that the input length. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- gobgp · Debian:11
The same CVE-2025-43973 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) written in Go. It is designed to provide a flexible and efficient routing solution for network operators. GoBGP supports various features such as route filtering, policy-based routing, and integration with other network services. However, prior to version 3.35.0, GoBGP had a vulnerability related to input length verification, which could lead to potential security risks.
Vulnerability Detail
An issue was discovered in GoBGP before version 3.35.0, specifically in the pkg/packet/rtr/rtr.go file. The vulnerability arises from the lack of verification that the input length corresponds to a situation where all bytes are available for an RTR message. This oversight can lead to unexpected behavior, including potential denial of service or data corruption, as the system may attempt to process incomplete or malformed messages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to update to the patched version as mentioned above.
Conclusion
In summary, CVE-2025-43973 is a significant vulnerability in GoBGP that requires immediate attention. Users are advised to update to version 3.35.0 or later to ensure their systems are secure against potential exploits stemming from this issue.
See every vulnerability recorded for github.com/osrg/gobgp →
FAQ
CVE-2025-43973 is a vulnerability in GoBGP that involves inadequate input length verification, potentially leading to security issues.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability can lead to denial of service or data corruption due to the processing of incomplete or malformed RTR messages.
Yes, the patch is available in GoBGP version 3.35.0 and later. It is crucial to update to this version to mitigate the risk.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp.
